Multi-factor authentication (MFA)
Overview
Multi-factor authentication (MFA) adds a second step to signing in to Kompass, after your password. Once it is set up, Kompass asks for a code from an authenticator app, or for your passkey, each time you sign in.
If you have no Kompass password and only sign in with Microsoft, MFA is handled by Microsoft and you cannot add MFA methods in Kompass.
Setting up an authenticator app
- In Kompass, open Settings, then Security, and click Manage MFA.
- Next to Authenticator app (TOTP), click Activate.
- Scan the QR code with an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. If you cannot scan it, click Can't scan? Enter the secret manually. and type the secret into your app.
- Enter the 6-digit code from the app in Verification code and click Activate.
The same page also lets you add a passkey (Touch ID, Windows Hello or a security key) instead of, or as well as, an authenticator app.
Recovery codes
When you set up your first authenticator app, Kompass creates 10 recovery codes and shows them once. Each code can be used once in place of an authenticator code. Copy them into a password manager or another safe place, then tick I have saved my recovery codes in a safe place and click Continue to Kompass.
The codes cannot be shown again. To get a new set, click Regenerate next to Recovery codes on the MFA page, then Generate new codes. Your old codes stop working.
Signing in with MFA
After you enter your password, Kompass shows the Two-Factor Authentication page:
- Enter the current 6-digit code from your authenticator app, or one of your recovery codes, in Authentication code and click Sign in.
- If you have a passkey, your browser asks for it straight away. If you dismiss the prompt, click Sign in with passkey to try again.
Kompass may then ask whether to trust this browser. If you click Trust for the number of days shown, you are not asked for a code when you sign in on this browser for that period (set by your administrator). Only do this on a device that you alone use. Otherwise click Don't trust.
Lost your authenticator
If you still have a recovery code, enter it on the Two-Factor Authentication page in place of an authenticator code. To move to a new authenticator app, open the MFA page, click Deactivate next to Authenticator app (TOTP), then activate it again with the new app. If MFA is required for your account, you cannot deactivate it yourself: ask an administrator to reset your MFA.
If you have lost both your authenticator and your recovery codes, ask an administrator to reset your MFA. See Resetting your password or MFA.
Required MFA
Your administrator may require MFA for all users, or for the members of a group. It is also required if you have been exempted from required Microsoft sign-in and sign in with a password. If MFA is required and you have not set it up, Kompass takes you to the MFA page after you sign in, and you need to add an authenticator app or a passkey before you can continue. While MFA is required, you cannot remove your last authenticator app or passkey.